CVE-2024-58237

In the Linux kernel, the following vulnerability has been resolved:

bpf: consider that tail calls invalidate packet pointers

Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers.

Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected:

int tail_call(struct __sk_buff *sk)
{
	bpf_tail_call_static(sk, &jmp_table, 0);
	return 0;
}

SEC("tc")
int not_safe(struct __sk_buff *sk)
{
	int *p = (void *)(long)sk->data;
	... make p valid ...
	tail_call(sk);
	*p = 42; /* this is unsafe */
	...
}

The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call.

This vulnerability is rated as Moderate impact for Red Hat because exploitation requires elevated privileges, such as CAP_BPF or CAP_NET_ADMIN, to load and attach specialized eBPF programs. In standard Red Hat Enterprise Linux configurations, unprivileged eBPF execution is disabled by default, preventing unprivileged local users from triggering the flaw. The issue occurs because the eBPF verifier fails to recognize that tail calls can alter packet buffers, potentially leading to stale pointer dereferences and a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.